<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      IO_FILE调试+详解 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        IO_FILE调试+详解
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-09-24
      </span>

                                                                        <span class="post-pubtime"> 本文共4.5k字 </span>

                                                                        <span class="post-pubtime">
        大约需要34min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<p>开始干__IO_FILE。会依次调fopen,fwrite,fread之类的IO函数的源码。</p>
<h1 id="IO-FILE之fopen详解"><a href="#IO-FILE之fopen详解" class="headerlink" title="IO_FILE之fopen详解"></a>IO_FILE之fopen详解</h1><h2 id="demo程序"><a href="#demo程序" class="headerlink" title="demo程序"></a>demo程序</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    FILE*fp=fopen(<span class="string">&quot;test&quot;</span>,<span class="string">&quot;wb&quot;</span>);</span><br><span class="line">    <span class="keyword">char</span> *ptr=<span class="built_in">malloc</span>(<span class="number">0x20</span>);</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="源码分析"><a href="#源码分析" class="headerlink" title="源码分析"></a>源码分析</h2><p>跟进去之后可以看到fopen实际是<code>_IO_new_fopen</code>函数。它调用的是<code>__fopen_internal</code></p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">─────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────────────────────────────────────────────────────────</span><br><span class="line">In file: /usr/src/glibc/glibc-2.23/libio/iofopen.c</span><br><span class="line">    91   return NULL;</span><br><span class="line">    92 &#125;</span><br><span class="line">    93 </span><br><span class="line">    94 _IO_FILE *</span><br><span class="line">    95 _IO_new_fopen (const char *filename, const char *mode)</span><br><span class="line"> ►  96 &#123;</span><br><span class="line">    97   return __fopen_internal (filename, mode, 1);</span><br><span class="line">    98 &#125;</span><br><span class="line">    99 </span><br><span class="line">   100 #ifdef _LIBC</span><br><span class="line">   101 strong_alias (_IO_new_fopen, __new_fopen)</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>跟进<code>__fopen_internal</code>看下</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line">_IO_FILE *__fopen_internal (<span class="keyword">const</span> <span class="keyword">char</span> *filename, <span class="keyword">const</span> <span class="keyword">char</span> *mode, <span class="keyword">int</span> is32)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="class"><span class="keyword">struct</span> <span class="title">locked_FILE</span></span></span><br><span class="line"><span class="class">  &#123;</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> _<span class="title">IO_FILE_plus</span> <span class="title">fp</span>;</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_MTSAFE_IO</span></span><br><span class="line">    _IO_lock_t lock;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> _<span class="title">IO_wide_data</span> <span class="title">wd</span>;</span></span><br><span class="line">  &#125; *new_f = (struct locked_FILE *) <span class="built_in">malloc</span> (<span class="keyword">sizeof</span> (struct locked_FILE));</span><br><span class="line">    <span class="comment">//step1:分配内存</span></span><br><span class="line">    </span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (new_f == <span class="literal">NULL</span>)</span><br><span class="line">    <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_MTSAFE_IO</span></span><br><span class="line">  new_f-&gt;fp.file._lock = &amp;new_f-&gt;lock;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> defined _LIBC || defined _GLIBCPP_USE_WCHAR_T</span></span><br><span class="line">  _IO_no_init (&amp;new_f-&gt;fp.file, <span class="number">0</span>, <span class="number">0</span>, &amp;new_f-&gt;wd, &amp;_IO_wfile_jumps);</span><br><span class="line">  <span class="comment">//step2:NULL初始化结构体数组  </span></span><br><span class="line">    </span><br><span class="line"><span class="meta">#<span class="meta-keyword">else</span></span></span><br><span class="line">  _IO_no_init (&amp;new_f-&gt;fp.file, <span class="number">1</span>, <span class="number">0</span>, <span class="literal">NULL</span>, <span class="literal">NULL</span>);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  _IO_JUMPS (&amp;new_f-&gt;fp) = &amp;_IO_file_jumps;<span class="comment">// 设置vtable为_IO_file_jumps</span></span><br><span class="line">  _IO_file_init (&amp;new_f-&gt;fp);<span class="comment">//step3:将file结构体链接进去_IO_list_all</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span>  !_IO_UNIFIED_JUMPTABLES</span></span><br><span class="line">  new_f-&gt;fp.vtable = <span class="literal">NULL</span>;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  <span class="comment">//打开文件</span></span><br><span class="line">  <span class="keyword">if</span> (_IO_file_fopen ((_IO_FILE *) new_f, filename, mode, is32) != <span class="literal">NULL</span>)</span><br><span class="line">    <span class="keyword">return</span> __fopen_maybe_mmap (&amp;new_f-&gt;fp.file);</span><br><span class="line"></span><br><span class="line">  _IO_un_link (&amp;new_f-&gt;fp);</span><br><span class="line">  <span class="built_in">free</span> (new_f);</span><br><span class="line">  <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  整个<code>__fopen_internal</code>函数包含四个部分：</p>
<ol>
<li>malloc分配内存</li>
<li><code>_IO_no_init</code> 对file结构体进行<code>null</code>初始化。</li>
<li><code>_IO_file_init</code>将结构体链接进<code>_IO_list_all</code>链表。</li>
<li><code>_IO_file_fopen</code>执行系统调用打开文件。</li>
</ol>
</blockquote>
<h3 id="step1-malloc分配内存空间"><a href="#step1-malloc分配内存空间" class="headerlink" title="step1:malloc分配内存空间"></a>step1:malloc分配内存空间</h3><p>可以看到先malloc了 <code>sizeof (struct locked_FILE)</code>大小的结构体，x64中为0x230，包含了三个结构体：<code>_IO_FILE_plus</code>，<code>_IO_lock_t</code>，<code>_IO_wide_data</code>。分别为fp，lock，wd。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> new_f</span></span><br><span class="line"><span class="meta">$</span><span class="bash">3 = (struct locked_FILE *) 0x602010</span></span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> x/10gx 0x602010-0x10</span></span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000231</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> *new_f</span></span><br><span class="line"><span class="meta">$</span><span class="bash">2 = &#123;</span></span><br><span class="line">  fp = &#123;</span><br><span class="line">    file = &#123;</span><br><span class="line">      _flags = 0, </span><br><span class="line">      _IO_read_ptr = 0x0, </span><br><span class="line">      _IO_read_end = 0x0, </span><br><span class="line">      _IO_read_base = 0x0, </span><br><span class="line">      _IO_write_base = 0x0, </span><br><span class="line">      _IO_write_ptr = 0x0, </span><br><span class="line">      _IO_write_end = 0x0, </span><br><span class="line">      _IO_buf_base = 0x0, </span><br><span class="line">      _IO_buf_end = 0x0, </span><br><span class="line">      _IO_save_base = 0x0, </span><br><span class="line">      _IO_backup_base = 0x0, </span><br><span class="line">      _IO_save_end = 0x0, </span><br><span class="line">      _markers = 0x0, </span><br><span class="line">      _chain = 0x0, </span><br><span class="line">      _fileno = 0, </span><br><span class="line">      _flags2 = 0, </span><br><span class="line">      _old_offset = 0, </span><br><span class="line">      _cur_column = 0, </span><br><span class="line">      _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">      _shortbuf = &quot;&quot;, </span><br><span class="line">      _lock = 0x0, </span><br><span class="line">      _offset = 0, </span><br><span class="line">      _codecvt = 0x0, </span><br><span class="line">      _wide_data = 0x0, </span><br><span class="line">      _freeres_list = 0x0, </span><br><span class="line">      _freeres_buf = 0x0, </span><br><span class="line">      __pad5 = 0, </span><br><span class="line">      _mode = 0, </span><br><span class="line">      _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">    &#125;, </span><br><span class="line">    vtable = 0x0</span><br><span class="line">  &#125;, </span><br><span class="line">  lock = &#123;</span><br><span class="line">    lock = 0, </span><br><span class="line">    cnt = 0, </span><br><span class="line">    owner = 0x0</span><br><span class="line">  &#125;, </span><br><span class="line">  wd = &#123;</span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _IO_state = &#123;</span><br><span class="line">      __count = 0, </span><br><span class="line">      __value = &#123;</span><br><span class="line">        __wch = 0, </span><br><span class="line">        __wchb = &quot;\000\000\000&quot;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;, </span><br><span class="line">    _IO_last_state = &#123;</span><br><span class="line">      __count = 0, </span><br><span class="line">      __value = &#123;</span><br><span class="line">        __wch = 0, </span><br><span class="line">        __wchb = &quot;\000\000\000&quot;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;, </span><br><span class="line">    _codecvt = &#123;</span><br><span class="line">      __codecvt_destr = 0x0, </span><br><span class="line">      __codecvt_do_out = 0x0, </span><br><span class="line">      __codecvt_do_unshift = 0x0, </span><br><span class="line">      __codecvt_do_in = 0x0, </span><br><span class="line">      __codecvt_do_encoding = 0x0, </span><br><span class="line">      __codecvt_do_always_noconv = 0x0, </span><br><span class="line">      __codecvt_do_length = 0x0, </span><br><span class="line">      __codecvt_do_max_length = 0x0, </span><br><span class="line">      __cd_in = &#123;</span><br><span class="line">        __cd = &#123;</span><br><span class="line">          __nsteps = 0, </span><br><span class="line">          __steps = 0x0, </span><br><span class="line">          __data = 0x6021b8</span><br><span class="line">        &#125;, </span><br><span class="line">        __combined = &#123;</span><br><span class="line">          __cd = &#123;</span><br><span class="line">            __nsteps = 0, </span><br><span class="line">            __steps = 0x0, </span><br><span class="line">            __data = 0x6021b8</span><br><span class="line">          &#125;, </span><br><span class="line">          __data = &#123;</span><br><span class="line">            __outbuf = 0x0, </span><br><span class="line">            __outbufend = 0x0, </span><br><span class="line">            __flags = 0, </span><br><span class="line">            __invocation_counter = 0, </span><br><span class="line">            __internal_use = 0, </span><br><span class="line">            __statep = 0x0, </span><br><span class="line">            __state = &#123;</span><br><span class="line">              __count = 0, </span><br><span class="line">              __value = &#123;</span><br><span class="line">                __wch = 0, </span><br><span class="line">                __wchb = &quot;\000\000\000&quot;</span><br><span class="line">              &#125;</span><br><span class="line">            &#125;</span><br><span class="line">          &#125;</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;, </span><br><span class="line">      __cd_out = &#123;</span><br><span class="line">        __cd = &#123;</span><br><span class="line">          __nsteps = 0, </span><br><span class="line">          __steps = 0x0, </span><br><span class="line">          __data = 0x6021f8</span><br><span class="line">        &#125;, </span><br><span class="line">        __combined = &#123;</span><br><span class="line">          __cd = &#123;</span><br><span class="line">            __nsteps = 0, </span><br><span class="line">            __steps = 0x0, </span><br><span class="line">            __data = 0x6021f8</span><br><span class="line">          &#125;, </span><br><span class="line">          __data = &#123;</span><br><span class="line">            __outbuf = 0x0, </span><br><span class="line">            __outbufend = 0x0, </span><br><span class="line">            __flags = 0, </span><br><span class="line">            __invocation_counter = 0, </span><br><span class="line">            __internal_use = 0, </span><br><span class="line">            __statep = 0x0, </span><br><span class="line">            __state = &#123;</span><br><span class="line">              __count = 0, </span><br><span class="line">              __value = &#123;</span><br><span class="line">                __wch = 0, </span><br><span class="line">                __wchb = &quot;\000\000\000&quot;</span><br><span class="line">              &#125;</span><br><span class="line">            &#125;</span><br><span class="line">          &#125;</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;, </span><br><span class="line">    _shortbuf = L&quot;&quot;, </span><br><span class="line">    _wide_vtable = 0x0</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h3 id="step2-IO-no-init-对file结构体进行null初始化"><a href="#step2-IO-no-init-对file结构体进行null初始化" class="headerlink" title="step2:_IO_no_init 对file结构体进行null初始化"></a>step2:_IO_no_init 对file结构体进行null初始化</h3><p>分配完后，调用了<code>_IO_no_init</code>初始化改结构体</p>
<p>跟进去，在<code>/libio/genops.c</code>中</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">void</span> _IO_old_init (_IO_FILE *fp, <span class="keyword">int</span> flags)</span><br><span class="line">&#123;</span><br><span class="line">  fp-&gt;_flags = _IO_MAGIC|flags;</span><br><span class="line">  fp-&gt;_flags2 = <span class="number">0</span>;</span><br><span class="line">  fp-&gt;_IO_buf_base = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_buf_end = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_read_base = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_read_ptr = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_read_end = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_write_base = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_write_ptr = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_write_end = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_chain = <span class="literal">NULL</span>; <span class="comment">/* Not necessary. */</span></span><br><span class="line"></span><br><span class="line">  fp-&gt;_IO_save_base = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_backup_base = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_IO_save_end = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_markers = <span class="literal">NULL</span>;</span><br><span class="line">  fp-&gt;_cur_column = <span class="number">0</span>;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> _IO_JUMPS_OFFSET</span></span><br><span class="line">  fp-&gt;_vtable_offset = <span class="number">0</span>;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_MTSAFE_IO</span></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_lock != <span class="literal">NULL</span>)</span><br><span class="line">    _IO_lock_init (*fp-&gt;_lock);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">void</span> _IO_no_init (_IO_FILE *fp, <span class="keyword">int</span> flags, <span class="keyword">int</span> orientation,</span><br><span class="line">	     struct _IO_wide_data *wd, <span class="keyword">const</span> struct _IO_jump_t *jmp)</span><br><span class="line">&#123;</span><br><span class="line">  _IO_old_init (fp, flags);</span><br><span class="line">  fp-&gt;_mode = orientation;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> defined _LIBC || defined _GLIBCPP_USE_WCHAR_T</span></span><br><span class="line">  <span class="keyword">if</span> (orientation &gt;= <span class="number">0</span>)</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="comment">//初始化_wide_data字段</span></span><br><span class="line">      fp-&gt;_wide_data = wd;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_buf_base = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_buf_end = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_read_base = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_read_ptr = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_read_end = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_write_base = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_write_ptr = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_write_end = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_save_base = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_backup_base = <span class="literal">NULL</span>;</span><br><span class="line">      fp-&gt;_wide_data-&gt;_IO_save_end = <span class="literal">NULL</span>;</span><br><span class="line"></span><br><span class="line">      fp-&gt;_wide_data-&gt;_wide_vtable = jmp;</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="comment">/* Cause predictable crash when a wide function is called on a byte</span></span><br><span class="line"><span class="comment">       stream.  */</span></span><br><span class="line">    fp-&gt;_wide_data = (struct _IO_wide_data *) <span class="number">-1L</span>;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  fp-&gt;_freeres_list = <span class="literal">NULL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>初始化了<code>locked_FILE</code>结构体中的<code>_IO_FILE_plus</code>结构体，以及其中的<code>_wide_data</code>字段，执行完<code>IO_no_init</code>后： </p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> new_f-&gt;fp</span></span><br><span class="line"><span class="meta">$</span><span class="bash">4 = &#123;</span></span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72548352, </span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x0, </span><br><span class="line">    _fileno = 0, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = 0, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = 0, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x0</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h3 id="step3-IO-file-init将结构体链接进-IO-list-all"><a href="#step3-IO-file-init将结构体链接进-IO-list-all" class="headerlink" title="step3: _IO_file_init将结构体链接进_IO_list_all"></a>step3: _IO_file_init将结构体链接进_IO_list_all</h3><p>回到<code>__fopen_internal</code>后，函数将<code>_IO_FILE_plus</code>结构体的vtable设置成了<code>_IO_file_jumps</code>，然后调用<code>_IO_file_init</code>将<code>_IO_FILE_plus</code>结构体链接进入<code>_IO_list_all</code>链表，跟进去后：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">void</span> _IO_new_file_init (struct _IO_FILE_plus *fp)</span><br><span class="line">&#123;</span><br><span class="line">  fp-&gt;file._offset = _IO_pos_BAD;</span><br><span class="line">  fp-&gt;file._IO_file_flags |= CLOSED_FILEBUF_FLAGS;</span><br><span class="line">  <span class="comment">//调用_IO_link_in并设置_fileno</span></span><br><span class="line">  _IO_link_in (fp);</span><br><span class="line">  fp-&gt;file._fileno = <span class="number">-1</span>;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_ver (_IO_new_file_init, _IO_file_init)</span><br></pre></td></tr></table></figure>

<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> *fp</span></span><br><span class="line"><span class="meta">$</span><span class="bash">9 = &#123;</span></span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72548352, </span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x0, </span><br><span class="line">    _fileno = 0, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = 0, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = 0, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x7ffff7dd06e0 &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>继续跟<code>_IO_link_in</code>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">void</span></span><br><span class="line">_IO_link_in (struct _IO_FILE_plus *fp)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="comment">//检查_flags标志位是否是_IO_LINKED</span></span><br><span class="line">  <span class="keyword">if</span> ((fp-&gt;file._flags &amp; _IO_LINKED) == <span class="number">0</span>)</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="comment">//设置标志位</span></span><br><span class="line">      fp-&gt;file._flags |= _IO_LINKED;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_MTSAFE_IO</span></span><br><span class="line">      _IO_cleanup_region_start_noarg (flush_cleanup);</span><br><span class="line">      _IO_lock_lock (list_all_lock);</span><br><span class="line">      run_fp = (_IO_FILE *) fp;</span><br><span class="line">      _IO_flockfile ((_IO_FILE *) fp);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">      fp-&gt;file._chain = (_IO_FILE *) _IO_list_all;</span><br><span class="line">      _IO_list_all = fp;</span><br><span class="line">      ++_IO_list_all_stamp;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_MTSAFE_IO</span></span><br><span class="line">      _IO_funlockfile ((_IO_FILE *) fp);</span><br><span class="line">      run_fp = <span class="literal">NULL</span>;</span><br><span class="line">      _IO_lock_unlock (list_all_lock);</span><br><span class="line">      _IO_cleanup_region_end (<span class="number">0</span>);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_link_in)</span><br></pre></td></tr></table></figure>

<p>FILE结构体是通过<code>_IO_list_all</code>的单链表来进行管理的 ，这里<code>_IO_link_in</code>是检查FILE结构体是否包含<code>_IO_LINKED</code>标志，如果不包含则表示这个结构体没有链接进<code>_IO_list_all</code>，之后会将它链接进<code>_IO_list_all</code>链表，同时设置<code>_chain</code>为之前的链表的值。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; print _IO_list_all</span><br><span class="line">$10 = (struct _IO_FILE_plus *) 0x7ffff7dd2540 &lt;_IO_2_1_stderr_&gt;</span><br><span class="line">pwndbg&gt; print _IO_list_all</span><br><span class="line">$11 = (struct _IO_FILE_plus *) 0x602010</span><br><span class="line">pwndbg&gt; print *fp</span><br><span class="line">$12 = &#123;</span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72538996, </span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x7ffff7dd2540 &lt;_IO_2_1_stderr_&gt;, </span><br><span class="line">    _fileno = 0, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = -1, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = 0, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x7ffff7dd06e0 &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>可以看到没有执行<code>_IO_file_init</code>的时候指向<code>stderr</code>结构体，执行后指向申请出来的结构体。</p>
<p>并且<code>_chain</code>指向<code>stderr</code>结构体。</p>
<h3 id="step4-IO-file-fopen打开文件句柄"><a href="#step4-IO-file-fopen打开文件句柄" class="headerlink" title="step4:_IO_file_fopen打开文件句柄"></a>step4:_IO_file_fopen打开文件句柄</h3><p>之后回到，继续跟进</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line">_IO_FILE * _IO_new_file_fopen (_IO_FILE *fp, <span class="keyword">const</span> <span class="keyword">char</span> *filename, <span class="keyword">const</span> <span class="keyword">char</span> *mode, <span class="keyword">int</span> is32not64)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">int</span> oflags = <span class="number">0</span>, omode;</span><br><span class="line">  <span class="keyword">int</span> read_write;</span><br><span class="line">  <span class="keyword">int</span> oprot = <span class="number">0666</span>;</span><br><span class="line">  <span class="keyword">int</span> i;</span><br><span class="line">  _IO_FILE *result;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _LIBC</span></span><br><span class="line">  <span class="keyword">const</span> <span class="keyword">char</span> *cs;</span><br><span class="line">  <span class="keyword">const</span> <span class="keyword">char</span> *last_recognized;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  <span class="comment">//检查文件是否已打开</span></span><br><span class="line">  <span class="keyword">if</span> (_IO_file_is_open (fp))</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  <span class="comment">//设置打开模式</span></span><br><span class="line">  <span class="keyword">switch</span> (*mode)</span><br><span class="line">    &#123;</span><br><span class="line">    <span class="keyword">case</span> <span class="string">&#x27;r&#x27;</span>:</span><br><span class="line">      omode = O_RDONLY;</span><br><span class="line">      read_write = _IO_NO_WRITES;</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">	...</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="comment">//调用_IO_file_open</span></span><br><span class="line">  result = _IO_file_open (fp, filename, omode|oflags, oprot, read_write,</span><br><span class="line">			  is32not64);</span><br><span class="line">  ...</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_ver (_IO_new_file_fopen, _IO_file_fopen)</span><br></pre></td></tr></table></figure>

<p>检查是否打开，之后设置打开模式，然后调用<code>_IO_file_open</code>继续跟进：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line">_IO_FILE *</span><br><span class="line">_IO_file_open (_IO_FILE *fp, <span class="keyword">const</span> <span class="keyword">char</span> *filename, <span class="keyword">int</span> posix_mode, <span class="keyword">int</span> prot,</span><br><span class="line">	       <span class="keyword">int</span> read_write, <span class="keyword">int</span> is32not64)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">int</span> fdesc;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _LIBC</span></span><br><span class="line">  <span class="keyword">if</span> (__glibc_unlikely (fp-&gt;_flags2 &amp; _IO_FLAGS2_NOTCANCEL))</span><br><span class="line">    fdesc = open_not_cancel (filename,</span><br><span class="line">			     posix_mode | (is32not64 ? <span class="number">0</span> : O_LARGEFILE), prot);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="comment">//调用系统函数open打开文件</span></span><br><span class="line">    fdesc = open (filename, posix_mode | (is32not64 ? <span class="number">0</span> : O_LARGEFILE), prot);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">else</span></span></span><br><span class="line">  fdesc = open (filename, posix_mode, prot);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  <span class="keyword">if</span> (fdesc &lt; <span class="number">0</span>)</span><br><span class="line">    <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">  <span class="comment">//将文件描述符写到_fileno字段里</span></span><br><span class="line">  fp-&gt;_fileno = fdesc;</span><br><span class="line">  _IO_mask_flags (fp, read_write,_IO_NO_READS+_IO_NO_WRITES+_IO_IS_APPENDING);</span><br><span class="line">  <span class="comment">/* For append mode, send the file offset to the end of the file.  Don&#x27;t</span></span><br><span class="line"><span class="comment">     update the offset cache though, since the file handle is not active.  */</span></span><br><span class="line">  <span class="keyword">if</span> ((read_write &amp; (_IO_IS_APPENDING | _IO_NO_READS))</span><br><span class="line">      == (_IO_IS_APPENDING | _IO_NO_READS))</span><br><span class="line">    &#123;</span><br><span class="line">      _IO_off64_t new_pos = _IO_SYSSEEK (fp, <span class="number">0</span>, _IO_seek_end);</span><br><span class="line">      <span class="keyword">if</span> (new_pos == _IO_pos_BAD &amp;&amp; errno != ESPIPE)</span><br><span class="line">	&#123;</span><br><span class="line">	  close_not_cancel (fdesc);</span><br><span class="line">	  <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">	&#125;</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="comment">//调用_IO_link_in</span></span><br><span class="line">  _IO_link_in ((struct _IO_FILE_plus *) fp);</span><br><span class="line">  <span class="keyword">return</span> fp;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_file_open)</span><br></pre></td></tr></table></figure>

<p>执行完后可以看到<code>_fileno</code>已经被设置：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> new_f-&gt;fp</span></span><br><span class="line"><span class="meta">$</span><span class="bash">17 = &#123;</span></span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72539004, </span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x7ffff7dd2540 &lt;_IO_2_1_stderr_&gt;, </span><br><span class="line">    _fileno = 3, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = -1, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = 0, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x7ffff7dd06e0 &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h2 id="小结"><a href="#小结" class="headerlink" title="小结"></a>小结</h2><p>fopen的流程：</p>
<blockquote>
<ol>
<li>malloc</li>
<li><code>_IO_no_init</code>初始化</li>
<li><code>_IO_file_init</code>将结构体链接进<code>_IO_list_all</code>链表</li>
<li><code>_IO_file_fopen</code>进行系统调用打开文件</li>
</ol>
</blockquote>
<p>整个流程还是比较简单的，fopen返回之后<code>_IO_list_all</code>链表指向返回的FILE结构体，且FILE结构体的_chain字段指向之前的结构体（没有其他额外打开文件的话，将是指向<code>stderr</code>），同时其他的字段大多都是默认的null值，<code>vtable</code>存储的是<code>__GI__IO_file_jumps</code>函数表，</p>
<h1 id="IO-FILE之fread详解"><a href="#IO-FILE之fread详解" class="headerlink" title="IO_FILE之fread详解"></a>IO_FILE之fread详解</h1><p>上面写了fopen的分析，讲了系统是如何为FILE结构体分配内存并将其链接进<code>_IO_list_all</code>中的。</p>
<p>本次来讲fread，实现从文件读数据。下面是本次fread的流程图：</p>
<p><img src="/2021/09/24/IO_FILE/image-20210925232855099.png" alt="image-20210925232855099"></p>
<p>fread的大致流程：</p>
<p>fread调用<code>_IO_sgetn</code>，之后<code>_IO_sgetn</code>调用vtable中的<code>_IO_XSGETN</code>也就是</p>
<p><code>_IO_file_xsgetn</code>，这个是fread的核心，简单流程：</p>
<ol>
<li>判断<code>fp-&gt;_IO_buf_base</code>输入缓冲区 是否为空，如果为空则调用<code>_IO_doallocbuf</code>初始化输入缓冲区</li>
<li>分配完输入缓冲区或者输入缓冲区不为空的情况下，判断输入缓冲区中是否有数据</li>
<li>如果有数据，直接拷贝到用户缓冲区，如果没有或不够则调用<code>__underflow</code>执行系统调用读取数据到输入缓冲区，再拷贝到用户缓冲区</li>
</ol>
<h2 id="demo"><a href="#demo" class="headerlink" title="demo"></a>demo</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line">    <span class="keyword">char</span> data[<span class="number">20</span>];</span><br><span class="line">    FILE*fp=fopen(<span class="string">&quot;test&quot;</span>,<span class="string">&quot;rb&quot;</span>);</span><br><span class="line">    fread(data,<span class="number">1</span>,<span class="number">20</span>,fp);</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h2 id="源码分析-1"><a href="#源码分析-1" class="headerlink" title="源码分析"></a>源码分析</h2><p>进到fread，看到调用了<code>_IO_fread</code></p>
<p>先看下FILE结构体的fp内容，可以看到<code>_IO_read_ptr</code>、<code>_IO_buf_base</code>等还是空的，后面的分析的重要的步骤也是看这些指针如何被赋值以及发挥作用的。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> *_IO_list_all</span></span><br><span class="line"><span class="meta">$</span><span class="bash">2 = &#123;</span></span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72539000, </span><br><span class="line">    _IO_read_ptr = 0x0, </span><br><span class="line">    _IO_read_end = 0x0, </span><br><span class="line">    _IO_read_base = 0x0, </span><br><span class="line">    _IO_write_base = 0x0, </span><br><span class="line">    _IO_write_ptr = 0x0, </span><br><span class="line">    _IO_write_end = 0x0, </span><br><span class="line">    _IO_buf_base = 0x0, </span><br><span class="line">    _IO_buf_end = 0x0, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x7ffff7dd2540 &lt;_IO_2_1_stderr_&gt;, </span><br><span class="line">    _fileno = 3, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = -1, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = 0, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x7ffff7dd06e0 &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> *_IO_list_all-&gt;vtable</span></span><br><span class="line"><span class="meta">$</span><span class="bash">3 = &#123;</span></span><br><span class="line">  __dummy = 0, </span><br><span class="line">  __dummy2 = 0, </span><br><span class="line">  __finish = 0x7ffff7a869d0 &lt;_IO_new_file_finish&gt;, </span><br><span class="line">  __overflow = 0x7ffff7a87740 &lt;_IO_new_file_overflow&gt;, </span><br><span class="line">  __underflow = 0x7ffff7a874b0 &lt;_IO_new_file_underflow&gt;, </span><br><span class="line">  __uflow = 0x7ffff7a88610 &lt;__GI__IO_default_uflow&gt;, </span><br><span class="line">  __pbackfail = 0x7ffff7a89990 &lt;__GI__IO_default_pbackfail&gt;, </span><br><span class="line">  __xsputn = 0x7ffff7a861f0 &lt;_IO_new_file_xsputn&gt;, </span><br><span class="line">  __xsgetn = 0x7ffff7a85ed0 &lt;__GI__IO_file_xsgetn&gt;, </span><br><span class="line">  __seekoff = 0x7ffff7a854d0 &lt;_IO_new_file_seekoff&gt;, </span><br><span class="line">  __seekpos = 0x7ffff7a88a10 &lt;_IO_default_seekpos&gt;, </span><br><span class="line">  __setbuf = 0x7ffff7a85440 &lt;_IO_new_file_setbuf&gt;, </span><br><span class="line">  __sync = 0x7ffff7a85380 &lt;_IO_new_file_sync&gt;, </span><br><span class="line">  __doallocate = 0x7ffff7a7a190 &lt;__GI__IO_file_doallocate&gt;, </span><br><span class="line">  __read = 0x7ffff7a861b0 &lt;__GI__IO_file_read&gt;, </span><br><span class="line">  __write = 0x7ffff7a85b80 &lt;_IO_new_file_write&gt;, </span><br><span class="line">  __seek = 0x7ffff7a85980 &lt;__GI__IO_file_seek&gt;, </span><br><span class="line">  __close = 0x7ffff7a85350 &lt;__GI__IO_file_close&gt;, </span><br><span class="line">  __stat = 0x7ffff7a85b70 &lt;__GI__IO_file_stat&gt;, </span><br><span class="line">  __showmanyc = 0x7ffff7a89b00 &lt;_IO_default_showmanyc&gt;, </span><br><span class="line">  __imbue = 0x7ffff7a89b10 &lt;_IO_default_imbue&gt;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>fread的调用：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line">_IO_size_t</span><br><span class="line">_IO_fread (<span class="keyword">void</span> *buf, _IO_size_t size, _IO_size_t count, _IO_FILE *fp)</span><br><span class="line">&#123;</span><br><span class="line">  _IO_size_t bytes_requested = size * count;</span><br><span class="line">  _IO_size_t bytes_read;</span><br><span class="line">  CHECK_FILE (fp, <span class="number">0</span>);</span><br><span class="line">  <span class="keyword">if</span> (bytes_requested == <span class="number">0</span>)</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  _IO_acquire_lock (fp);</span><br><span class="line">    </span><br><span class="line">  <span class="comment">//调用_IO_sgetn函数</span></span><br><span class="line">  bytes_read = _IO_sgetn (fp, (<span class="keyword">char</span> *) buf, bytes_requested);</span><br><span class="line">  _IO_release_lock (fp);</span><br><span class="line">  <span class="keyword">return</span> bytes_requested == bytes_read ? count : bytes_read / size;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_fread)</span><br></pre></td></tr></table></figure>

<p>继续跟进<code>_IO_sgetn</code>函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">_IO_size_t</span><br><span class="line">_IO_sgetn (_IO_FILE *fp, <span class="keyword">void</span> *data, _IO_size_t n)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="comment">/* FIXME handle putback buffer here! */</span></span><br><span class="line">  <span class="keyword">return</span> _IO_XSGETN (fp, data, n);</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_sgetn)</span><br></pre></td></tr></table></figure>

<p>可以看到他的调用是<code>_IO_XSGETN</code>函数，它的定义：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">define</span> _IO_XSGETN(FP, DATA, N) JUMP2 (__xsgetn, FP, DATA, N)</span></span><br></pre></td></tr></table></figure>

<p>实际就是调用了vtable中的<code>__xsgetn</code>函数，继续跟：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br></pre></td><td class="code"><pre><span class="line">_IO_size_t</span><br><span class="line">_IO_file_xsgetn (_IO_FILE *fp, <span class="keyword">void</span> *data, _IO_size_t n)</span><br><span class="line">&#123;</span><br><span class="line">  _IO_size_t want, have;</span><br><span class="line">  _IO_ssize_t count;</span><br><span class="line">  <span class="keyword">char</span> *s = data;</span><br><span class="line"></span><br><span class="line">  want = n;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_IO_buf_base == <span class="literal">NULL</span>)</span><br><span class="line">    &#123;</span><br><span class="line">	  ....</span><br><span class="line">      <span class="comment">//step1：如果fp-&gt;_IO_buf_base == NULL，调用_IO_doallocbuf</span></span><br><span class="line">      _IO_doallocbuf (fp);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">while</span> (want &gt; <span class="number">0</span>)</span><br><span class="line">    &#123;</span><br><span class="line">      have = fp-&gt;_IO_read_end - fp-&gt;_IO_read_ptr;</span><br><span class="line">      <span class="comment">//step2：如果输入缓冲区中已有足够的字符，直接将缓冲区中的字符给目标buf</span></span><br><span class="line">      <span class="keyword">if</span> (want &lt;= have)</span><br><span class="line">	&#123;</span><br><span class="line">	  <span class="built_in">memcpy</span> (s, fp-&gt;_IO_read_ptr, want);</span><br><span class="line">	  fp-&gt;_IO_read_ptr += want;</span><br><span class="line">	  want = <span class="number">0</span>;</span><br><span class="line">	&#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">	&#123;</span><br><span class="line">      <span class="comment">//如果缓冲区中有部分字符，但没有达到fread的size，先将已有的拷贝到目标buf</span></span><br><span class="line">	  <span class="keyword">if</span> (have &gt; <span class="number">0</span>)</span><br><span class="line">	    &#123;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _LIBC</span></span><br><span class="line">	      s = __mempcpy (s, fp-&gt;_IO_read_ptr, have);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">else</span></span></span><br><span class="line">	      <span class="built_in">memcpy</span> (s, fp-&gt;_IO_read_ptr, have);</span><br><span class="line">	      s += have;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">	      want -= have;</span><br><span class="line">	      fp-&gt;_IO_read_ptr += have;</span><br><span class="line">	    &#125;</span><br><span class="line"></span><br><span class="line">	  <span class="comment">/* Check for backup and repeat */</span></span><br><span class="line">	  <span class="keyword">if</span> (_IO_in_backup (fp))</span><br><span class="line">	    &#123;</span><br><span class="line">	      _IO_switch_to_main_get_area (fp);</span><br><span class="line">	      <span class="keyword">continue</span>;</span><br><span class="line">	    &#125;</span><br><span class="line"></span><br><span class="line">	  <span class="comment">/* If we now want less than a buffer, underflow and repeat</span></span><br><span class="line"><span class="comment">	     the copy.  Otherwise, _IO_SYSREAD directly to</span></span><br><span class="line"><span class="comment">	     the user buffer. */</span></span><br><span class="line">	  <span class="keyword">if</span> (fp-&gt;_IO_buf_base</span><br><span class="line">	      &amp;&amp; want &lt; (<span class="keyword">size_t</span>) (fp-&gt;_IO_buf_end - fp-&gt;_IO_buf_base))</span><br><span class="line">	    &#123;</span><br><span class="line">	      <span class="keyword">if</span> (__underflow (fp) == EOF)</span><br><span class="line">             <span class="comment">//step3：如果输入缓冲区不能满足要求，调用__underflow读数据</span></span><br><span class="line">			<span class="keyword">break</span>;</span><br><span class="line">	      <span class="keyword">continue</span>;</span><br><span class="line">	    &#125;</span><br><span class="line"></span><br><span class="line">	  .....</span><br><span class="line">  <span class="keyword">return</span> n - want;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_file_xsgetn)</span><br></pre></td></tr></table></figure>

<p>函数<code>_IO_file_xsgetn</code>是fread的核心，分为以下几个部分：</p>
<ol>
<li>如果<code>fp-&gt;_IO_buf_base == NULL</code>，表名输入缓冲区还未建立，调用<code>_IO_doallocbuf</code>初始化指针，建立输入缓冲区</li>
<li>输入缓冲区中有数据，即<code>fp-&gt;_IO_read_ptr</code>小于<code>fp-&gt;_IO_read_end</code>，直接将输入缓冲区中的内筒拷贝到目标buf</li>
<li>输入缓冲区为空或者不能满足全部的需求，调用<code>__underflow</code>调用系统调用读入数据</li>
</ol>
<p>接下来就是具体介绍这几个部分。</p>
<h3 id="step1：初始化输入缓冲区"><a href="#step1：初始化输入缓冲区" class="headerlink" title="step1：初始化输入缓冲区"></a>step1：初始化输入缓冲区</h3><p>如果<code>fp-&gt;_IO_buf_base == NULL</code>则调用<code>_IO_doallocbuf</code>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">void</span></span><br><span class="line">_IO_doallocbuf (_IO_FILE *fp)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_IO_buf_base)</span><br><span class="line">    <span class="keyword">return</span>;</span><br><span class="line">  <span class="keyword">if</span> (!(fp-&gt;_flags &amp; _IO_UNBUFFERED) || fp-&gt;_mode &gt; <span class="number">0</span>)</span><br><span class="line">    <span class="keyword">if</span> (_IO_DOALLOCATE (fp) != EOF)</span><br><span class="line">      <span class="keyword">return</span>;</span><br><span class="line">  _IO_setb (fp, fp-&gt;_shortbuf, fp-&gt;_shortbuf+<span class="number">1</span>, <span class="number">0</span>);</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_doallocbuf)</span><br></pre></td></tr></table></figure>

<p>先检查<code>fp-&gt;_IO_buf_base</code>是否为空，不为空代表缓冲区已被初始化，直接返回，然后检查<code>fp-&gt;_flags</code>是不是<code>_IO_UNBUFFERED</code>或者<code>fp-&gt;_mode</code>大于0。</p>
<p>如果满足则执行<code>_IO_DOALLOCATE</code>，及调用vtable中的<code>_IO_file_doallocate</code>，跟进去看看：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span></span><br><span class="line">_IO_file_doallocate (_IO_FILE *fp)</span><br><span class="line">&#123;</span><br><span class="line">  _IO_size_t size;</span><br><span class="line">  <span class="keyword">char</span> *p;</span><br><span class="line">  <span class="class"><span class="keyword">struct</span> <span class="title">stat64</span> <span class="title">st</span>;</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifndef</span> _LIBC</span></span><br><span class="line">  <span class="comment">/* If _IO_cleanup_registration_needed is non-zero, we should call the</span></span><br><span class="line"><span class="comment">     function it points to.  This is to make sure _IO_cleanup gets called</span></span><br><span class="line"><span class="comment">     on exit.  We call it from _IO_file_doallocate, since that is likely</span></span><br><span class="line"><span class="comment">     to get called by any program that does buffered I/O. */</span></span><br><span class="line">  <span class="keyword">if</span> (__glibc_unlikely (_IO_cleanup_registration_needed != <span class="literal">NULL</span>))</span><br><span class="line">    (*_IO_cleanup_registration_needed) ();</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line"></span><br><span class="line">  size = _IO_BUFSIZ;</span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_fileno &gt;= <span class="number">0</span> &amp;&amp; __builtin_expect (_IO_SYSSTAT (fp, &amp;st), <span class="number">0</span>) &gt;= <span class="number">0</span>)</span><br><span class="line">      <span class="comment">//调用_IO_SYSSTAT获取FILE信息</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (S_ISCHR (st.st_mode))</span><br><span class="line">	&#123;</span><br><span class="line">	  <span class="comment">/* Possibly a tty.  */</span></span><br><span class="line">	  <span class="keyword">if</span> (</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> DEV_TTY_P</span></span><br><span class="line">	      DEV_TTY_P (&amp;st) ||</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">	      local_isatty (fp-&gt;_fileno))</span><br><span class="line">	    fp-&gt;_flags |= _IO_LINE_BUF;</span><br><span class="line">	&#125;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> _IO_HAVE_ST_BLKSIZE</span></span><br><span class="line">      <span class="keyword">if</span> (st.st_blksize &gt; <span class="number">0</span>)</span><br><span class="line">	size = st.st_blksize;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">    &#125;</span><br><span class="line">  p = <span class="built_in">malloc</span> (size);</span><br><span class="line">  <span class="keyword">if</span> (__glibc_unlikely (p == <span class="literal">NULL</span>))</span><br><span class="line">    <span class="keyword">return</span> EOF;</span><br><span class="line">  _IO_setb (fp, p, p + size, <span class="number">1</span>);</span><br><span class="line">  <span class="comment">//调用_IO_setb设置缓冲区</span></span><br><span class="line">  <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_file_doallocate)</span><br></pre></td></tr></table></figure>

<p>可以看到<code>_IO_file_doallocate</code>先调用<code>_IO_SYSSTAT</code>获取文件信息（<code>_IO_SYSSTAT</code>是vtable中的<code>_start</code>函数，获取文件信息，修改相应需要申请的size）：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> st</span></span><br><span class="line"><span class="meta">$</span><span class="bash">7 = &#123;</span></span><br><span class="line">  st_dev = 2049, </span><br><span class="line">  st_ino = 545917, </span><br><span class="line">  st_nlink = 1, </span><br><span class="line">  st_mode = 33188, </span><br><span class="line">  st_uid = 1000, </span><br><span class="line">  st_gid = 1000, </span><br><span class="line">  __pad0 = 0, </span><br><span class="line">  st_rdev = 0, </span><br><span class="line">  st_size = 0, </span><br><span class="line">  st_blksize = 4096, </span><br><span class="line">  st_blocks = 0, </span><br><span class="line">  st_atim = &#123;</span><br><span class="line">    tv_sec = 1632561914, </span><br><span class="line">    tv_nsec = 519216733</span><br><span class="line">  &#125;, </span><br><span class="line">  st_mtim = &#123;</span><br><span class="line">    tv_sec = 1632490672, </span><br><span class="line">    tv_nsec = 158707989</span><br><span class="line">  &#125;, </span><br><span class="line">  st_ctim = &#123;</span><br><span class="line">    tv_sec = 1632490672, </span><br><span class="line">    tv_nsec = 158707989</span><br><span class="line">  &#125;, </span><br><span class="line">  __glibc_reserved = &#123;0, 0, 0&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>可以看到<code>st_blksize</code>为0x1000，malloc之后调用了<code>_IO_setb</code>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">void</span></span><br><span class="line">_IO_setb (_IO_FILE *f, <span class="keyword">char</span> *b, <span class="keyword">char</span> *eb, <span class="keyword">int</span> a)</span><br><span class="line">&#123;</span><br><span class="line">  <span class="keyword">if</span> (f-&gt;_IO_buf_base &amp;&amp; !(f-&gt;_flags &amp; _IO_USER_BUF))</span><br><span class="line">    <span class="built_in">free</span> (f-&gt;_IO_buf_base);</span><br><span class="line">  f-&gt;_IO_buf_base = b;<span class="comment">//设置了_IO_buf_base </span></span><br><span class="line">  f-&gt;_IO_buf_end = eb;<span class="comment">//设置_IO_buf_end</span></span><br><span class="line">  <span class="keyword">if</span> (a)</span><br><span class="line">    f-&gt;_flags &amp;= ~_IO_USER_BUF;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    f-&gt;_flags |= _IO_USER_BUF;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (_IO_setb)</span><br></pre></td></tr></table></figure>

<p>设置了<code>_IO_buf_base</code>和<code>_IO_buf_end</code>，<code>_IO_setb</code>执行完后<code>_IO_buf_base</code>和<code>_IO_buf_end</code>已被赋值：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; print *_IO_list_all</span><br><span class="line">$<span class="number">2</span> = &#123;</span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = <span class="number">-72539000</span>, </span><br><span class="line">    _IO_read_ptr = <span class="number">0x0</span>, </span><br><span class="line">    _IO_read_end = <span class="number">0x0</span>, </span><br><span class="line">    _IO_read_base = <span class="number">0x0</span>, </span><br><span class="line">    _IO_write_base = <span class="number">0x0</span>, </span><br><span class="line">    _IO_write_ptr = <span class="number">0x0</span>, </span><br><span class="line">    _IO_write_end = <span class="number">0x0</span>, </span><br><span class="line">    _IO_buf_base = <span class="number">0x602240</span> <span class="string">&quot;&quot;</span>, </span><br><span class="line">    _IO_buf_end = <span class="number">0x603240</span> <span class="string">&quot;&quot;</span>, </span><br><span class="line">    _IO_save_base = <span class="number">0x0</span>, </span><br><span class="line">    _IO_backup_base = <span class="number">0x0</span>, </span><br><span class="line">    _IO_save_end = <span class="number">0x0</span>, </span><br><span class="line">    _markers = <span class="number">0x0</span>, </span><br><span class="line">    _chain = <span class="number">0x7ffff7dd2540</span> &lt;_IO_2_1_stderr_&gt;, </span><br><span class="line">    _fileno = <span class="number">3</span>, </span><br><span class="line">    _flags2 = <span class="number">0</span>, </span><br><span class="line">    _old_offset = <span class="number">0</span>, </span><br><span class="line">    _cur_column = <span class="number">0</span>, </span><br><span class="line">    _vtable_offset = <span class="number">0</span> <span class="string">&#x27;\000&#x27;</span>, </span><br><span class="line">    _shortbuf = <span class="string">&quot;&quot;</span>, </span><br><span class="line">    _lock = <span class="number">0x6020f0</span>, </span><br><span class="line">    _offset = <span class="number">-1</span>, </span><br><span class="line">    _codecvt = <span class="number">0x0</span>, </span><br><span class="line">    _wide_data = <span class="number">0x602100</span>, </span><br><span class="line">    _freeres_list = <span class="number">0x0</span>, </span><br><span class="line">    _freeres_buf = <span class="number">0x0</span>, </span><br><span class="line">    __pad5 = <span class="number">0</span>, </span><br><span class="line">    _mode = <span class="number">0</span>, </span><br><span class="line">    _unused2 = <span class="string">&#x27;\000&#x27;</span> &lt;repeats <span class="number">19</span> times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = <span class="number">0x7ffff7dd06e0</span> &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>初始化之后返回到<code>_IO_file_doallocate</code>，然后<code>_IO_file_doallocate</code>也执行完成 ，返回到<code>_IO_file_xsgetn</code>中。</p>
<h3 id="step2：拷贝输入缓冲区数据"><a href="#step2：拷贝输入缓冲区数据" class="headerlink" title="step2：拷贝输入缓冲区数据"></a>step2：拷贝输入缓冲区数据</h3><p>初始化完成后就到了第二步，拷贝输入缓冲区数据。如果输入缓冲区中已有足够的字符，直接将缓冲区中的字符给目标buf。<code>fp-&gt;_IO_read_ptr</code>指向的是输入缓冲区的其实地址，<code>fp-&gt;_IO_read_end</code>指向输入缓冲区的结束。</p>
<h3 id="step3：执行系统调用读取数据"><a href="#step3：执行系统调用读取数据" class="headerlink" title="step3：执行系统调用读取数据"></a>step3：执行系统调用读取数据</h3><p>当输入缓冲区为0或者不能满足需求的时候会执行<code>__underflow</code>调用系统调用read读取数据并放到输入缓冲区中：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span></span><br><span class="line">__underflow (_IO_FILE *fp)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="comment">//一些检查</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> defined _LIBC || defined _GLIBCPP_USE_WCHAR_T</span></span><br><span class="line">  <span class="keyword">if</span> (_IO_vtable_offset (fp) == <span class="number">0</span> &amp;&amp; _IO_fwide (fp, <span class="number">-1</span>) != <span class="number">-1</span>)</span><br><span class="line">    <span class="keyword">return</span> EOF;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_mode == <span class="number">0</span>)</span><br><span class="line">    _IO_fwide (fp, <span class="number">-1</span>);</span><br><span class="line">  <span class="keyword">if</span> (_IO_in_put_mode (fp))</span><br><span class="line">    <span class="keyword">if</span> (_IO_switch_to_get_mode (fp) == EOF)</span><br><span class="line">      <span class="keyword">return</span> EOF;</span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_IO_read_ptr &lt; fp-&gt;_IO_read_end)</span><br><span class="line">    <span class="keyword">return</span> *(<span class="keyword">unsigned</span> <span class="keyword">char</span> *) fp-&gt;_IO_read_ptr;</span><br><span class="line">  <span class="keyword">if</span> (_IO_in_backup (fp))</span><br><span class="line">    &#123;</span><br><span class="line">      _IO_switch_to_main_get_area (fp);</span><br><span class="line">      <span class="keyword">if</span> (fp-&gt;_IO_read_ptr &lt; fp-&gt;_IO_read_end)</span><br><span class="line">	<span class="keyword">return</span> *(<span class="keyword">unsigned</span> <span class="keyword">char</span> *) fp-&gt;_IO_read_ptr;</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="keyword">if</span> (_IO_have_markers (fp))</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (save_for_backup (fp, fp-&gt;_IO_read_end))</span><br><span class="line">	<span class="keyword">return</span> EOF;</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="keyword">else</span> <span class="keyword">if</span> (_IO_have_backup (fp))</span><br><span class="line">    _IO_free_backup_area (fp);</span><br><span class="line">  <span class="keyword">return</span> _IO_UNDERFLOW (fp);</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_def (__underflow)</span><br></pre></td></tr></table></figure>

<p>其中一个检查是如果<code>fp-&gt;_IO_read_ptr</code>小于<code>fp-&gt;_IO_read_end</code>则表明输入缓冲区里存在数据，可直接返回，否则则表示需要继续读入数据。都通过的话会执行<code>_IO_UNDERFLOW</code>，它是vtable中的<code>_IO_new_file_underflow</code>：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">int</span></span><br><span class="line">_IO_new_file_underflow (_IO_FILE *fp)</span><br><span class="line">&#123;</span><br><span class="line">  _IO_ssize_t count;</span><br><span class="line">  ...</span><br><span class="line">  <span class="comment">// 如果存在_IO_NO_READS标志，则直接返回</span></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_flags &amp; _IO_NO_READS)</span><br><span class="line">    &#123;</span><br><span class="line">      fp-&gt;_flags |= _IO_ERR_SEEN;</span><br><span class="line">      __set_errno (EBADF);</span><br><span class="line">      <span class="keyword">return</span> EOF;</span><br><span class="line">    &#125;</span><br><span class="line">  <span class="comment">// 如果输入缓冲区里存在数据，则直接返回</span></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_IO_read_ptr &lt; fp-&gt;_IO_read_end)</span><br><span class="line">    <span class="keyword">return</span> *(<span class="keyword">unsigned</span> <span class="keyword">char</span> *) fp-&gt;_IO_read_ptr;</span><br><span class="line">  ...</span><br><span class="line">  <span class="comment">// 如果没有输入缓冲区，则调用_IO_doallocbuf分配输入缓冲区</span></span><br><span class="line">  <span class="keyword">if</span> (fp-&gt;_IO_buf_base == <span class="literal">NULL</span>)</span><br><span class="line">    &#123;</span><br><span class="line">      ...</span><br><span class="line">      _IO_doallocbuf (fp);</span><br><span class="line">    &#125;</span><br><span class="line">  ...</span><br><span class="line">  <span class="comment">// 设置FILE结构体指针</span></span><br><span class="line">  fp-&gt;_IO_read_base = fp-&gt;_IO_read_ptr = fp-&gt;_IO_buf_base;</span><br><span class="line">  fp-&gt;_IO_read_end = fp-&gt;_IO_buf_base;</span><br><span class="line">  fp-&gt;_IO_write_base = fp-&gt;_IO_write_ptr = fp-&gt;_IO_write_end</span><br><span class="line">    = fp-&gt;_IO_buf_base;</span><br><span class="line">  <span class="comment">//调用_IO_SYSREAD函数最终执行系统调用读取数据</span></span><br><span class="line">  count = _IO_SYSREAD (fp, fp-&gt;_IO_buf_base,</span><br><span class="line">           fp-&gt;_IO_buf_end - fp-&gt;_IO_buf_base);</span><br><span class="line">  ...</span><br><span class="line">  <span class="comment">// 设置结构体指针</span></span><br><span class="line">  fp-&gt;_IO_read_end += count;</span><br><span class="line">  ...</span><br><span class="line">  <span class="keyword">return</span> *(<span class="keyword">unsigned</span> <span class="keyword">char</span> *) fp-&gt;_IO_read_ptr;</span><br><span class="line">&#125;</span><br><span class="line">libc_hidden_ver (_IO_new_file_underflow, _IO_file_underflow)</span><br></pre></td></tr></table></figure>

<p><code>_IO_new_file_underflow</code>是最终执行系统调用的地方，调用前仍有一些检查：</p>
<ol>
<li>检查FILE结构体的<code>_flag</code>标志位是否包含<code>_IO_NO_READS</code>，如果存在这个标志位则直接返回<code>EOF</code>，其中<code>_IO_NO_READS</code>标志位的定义是<code>#define _IO_NO_READS 4 /* Reading not allowed */</code>。</li>
<li>如果<code>fp-&gt;_IO_buf_base</code>位null，则调用<code>_IO_doallocbuf</code>分配输入缓冲区。</li>
<li>接着初始化设置FILE结构体指针，将他们都设置成<code>fp-&gt;_IO_buf_base</code></li>
<li>调用<code>_IO_SYSREAD</code>（vtable中的<code>_IO_file_read</code>函数），该函数最终执行系统调用read，读取文件数据，数据读入到<code>fp-&gt;_IO_buf_base</code>中，读入大小为输入缓冲区的大小<code>fp-&gt;_IO_buf_end - fp-&gt;_IO_buf_base</code>。</li>
<li>设置输入缓冲区已有数据的size，即设置<code>fp-&gt;_IO_read_end</code>为<code>fp-&gt;_IO_read_end += count</code>。</li>
</ol>
<p>其中第四步的<code>_IO_SYSREAD</code>（vtable中的<code>_IO_file_read</code>函数）：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">_IO_ssize_t</span><br><span class="line">_IO_file_read (_IO_FILE *fp, <span class="keyword">void</span> *buf, _IO_ssize_t size)</span><br><span class="line">&#123;</span><br><span class="line">   <span class="keyword">return</span> (__builtin_expect (fp-&gt;_flags2 &amp; _IO_FLAGS2_NOTCANCEL, <span class="number">0</span>)</span><br><span class="line">           ? read_not_cancel (fp-&gt;_fileno, buf, size)</span><br><span class="line">           : read (fp-&gt;_fileno, buf, size));</span><br><span class="line"> &#125;</span><br></pre></td></tr></table></figure>

<p>执行完后，FILE结构体的各个指针已被赋值，</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> <span class="built_in">print</span> *_IO_list_all</span></span><br><span class="line"><span class="meta">$</span><span class="bash">6 = &#123;</span></span><br><span class="line">  file = &#123;</span><br><span class="line">    _flags = -72539000, </span><br><span class="line">    _IO_read_ptr = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_read_end = 0x60224a &quot;&quot;, </span><br><span class="line">    _IO_read_base = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_write_base = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_write_ptr = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_write_end = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_buf_base = 0x602240 &quot;111111111\n&quot;, </span><br><span class="line">    _IO_buf_end = 0x603240 &quot;&quot;, </span><br><span class="line">    _IO_save_base = 0x0, </span><br><span class="line">    _IO_backup_base = 0x0, </span><br><span class="line">    _IO_save_end = 0x0, </span><br><span class="line">    _markers = 0x0, </span><br><span class="line">    _chain = 0x7ffff7dd2540 &lt;_IO_2_1_stderr_&gt;, </span><br><span class="line">    _fileno = 3, </span><br><span class="line">    _flags2 = 0, </span><br><span class="line">    _old_offset = 0, </span><br><span class="line">    _cur_column = 0, </span><br><span class="line">    _vtable_offset = 0 &#x27;\000&#x27;, </span><br><span class="line">    _shortbuf = &quot;&quot;, </span><br><span class="line">    _lock = 0x6020f0, </span><br><span class="line">    _offset = -1, </span><br><span class="line">    _codecvt = 0x0, </span><br><span class="line">    _wide_data = 0x602100, </span><br><span class="line">    _freeres_list = 0x0, </span><br><span class="line">    _freeres_buf = 0x0, </span><br><span class="line">    __pad5 = 0, </span><br><span class="line">    _mode = -1, </span><br><span class="line">    _unused2 = &#x27;\000&#x27; &lt;repeats 19 times&gt;</span><br><span class="line">  &#125;, </span><br><span class="line">  vtable = 0x7ffff7dd06e0 &lt;_IO_file_jumps&gt;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="小结-1"><a href="#小结-1" class="headerlink" title="小结"></a>小结</h2><ol>
<li><code>_IO_sgetn</code>函数调用了vtable的<code>_IO_file_xsgetn</code>。</li>
<li><code>_IO_doallocbuf</code>函数调用了vtable的<code>_IO_file_doallocate</code>以初始化输入缓冲区。</li>
<li>vtable中的<code>_IO_file_doallocate</code>调用了vtable中的<code>__GI__IO_file_stat</code>以获取文件信息。</li>
<li><code>__underflow</code>函数调用了vtable中的<code>_IO_new_file_underflow</code>实现文件数据读取。</li>
<li>vtable中的<code>_IO_new_file_underflow</code>调用了vtable<code>__GI__IO_file_read</code>最终去执行系统调用read。</li>
</ol>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/09/16/BUU-WEB-0x30-0x3F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-09-24
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/10/05/PHP%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%95%B4%E7%90%86/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#IO-FILE%E4%B9%8Bfopen%E8%AF%A6%E8%A7%A3"><span class="toc-text">IO_FILE之fopen详解</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#demo%E7%A8%8B%E5%BA%8F"><span class="toc-text">demo程序</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90"><span class="toc-text">源码分析</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#step1-malloc%E5%88%86%E9%85%8D%E5%86%85%E5%AD%98%E7%A9%BA%E9%97%B4"><span class="toc-text">step1:malloc分配内存空间</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step2-IO-no-init-%E5%AF%B9file%E7%BB%93%E6%9E%84%E4%BD%93%E8%BF%9B%E8%A1%8Cnull%E5%88%9D%E5%A7%8B%E5%8C%96"><span class="toc-text">step2:_IO_no_init 对file结构体进行null初始化</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step3-IO-file-init%E5%B0%86%E7%BB%93%E6%9E%84%E4%BD%93%E9%93%BE%E6%8E%A5%E8%BF%9B-IO-list-all"><span class="toc-text">step3: _IO_file_init将结构体链接进_IO_list_all</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step4-IO-file-fopen%E6%89%93%E5%BC%80%E6%96%87%E4%BB%B6%E5%8F%A5%E6%9F%84"><span class="toc-text">step4:_IO_file_fopen打开文件句柄</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%B0%8F%E7%BB%93"><span class="toc-text">小结</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#IO-FILE%E4%B9%8Bfread%E8%AF%A6%E8%A7%A3"><span class="toc-text">IO_FILE之fread详解</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#demo"><span class="toc-text">demo</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90-1"><span class="toc-text">源码分析</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#step1%EF%BC%9A%E5%88%9D%E5%A7%8B%E5%8C%96%E8%BE%93%E5%85%A5%E7%BC%93%E5%86%B2%E5%8C%BA"><span class="toc-text">step1：初始化输入缓冲区</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step2%EF%BC%9A%E6%8B%B7%E8%B4%9D%E8%BE%93%E5%85%A5%E7%BC%93%E5%86%B2%E5%8C%BA%E6%95%B0%E6%8D%AE"><span class="toc-text">step2：拷贝输入缓冲区数据</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step3%EF%BC%9A%E6%89%A7%E8%A1%8C%E7%B3%BB%E7%BB%9F%E8%B0%83%E7%94%A8%E8%AF%BB%E5%8F%96%E6%95%B0%E6%8D%AE"><span class="toc-text">step3：执行系统调用读取数据</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%B0%8F%E7%BB%93-1"><span class="toc-text">小结</span></a></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + IO_FILE%E8%B0%83%E8%AF%95%2B%E8%AF%A6%E8%A7%A3 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F09%2F24%2FIO_FILE%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/09/24/IO_FILE/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
